CVE-2025-24839

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 10.5.0, <= 10.5.1; >= 10.4.0, <= 10.4.3; >= 9.11.0, <= 9.11.9

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Apr 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-24846.1The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'video_id' and 'group_id' parameters in all CVE-2025-248405.8Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthe CVE-2025-248415.4Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 CVE-2025-248426.7Uncontrolled search path for the Intel(R) System Support Utility before version 4.1.0 within Ring 3: User Applications may allow an escalati CVE-2025-248435.1Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confidentiality, integrity,CVE-2025-248445.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-248455.5Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.CVE-2025-248467.5Authentication bypass vulnerability exists in FutureNet AS series (Industrial Routers) provided by Century Systems Co., Ltd. If this vulnera CVE-2025-248474.5Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an in CVE-2025-248486.3Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an CVE-2025-248497.1Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure.CVE-2025-24858.8The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to,